OpenSAML user discussion

[Scott Cantor <>]

> I need to include a cookie when sending a SAMLRequest via 
> SAMLSOAPBinding's send method. Is there a way to do it?

Not currently. It wouldn't be inordinately hard to add that, but by some
interpretations, that would violate the SAML spec, since it would introduce
an HTTP header that shouldn't need to be there for a SAML authority to
respond.

OTOH, I could see implementing some kind of session-based authentication
between the client and the authority that would need a cookie, so it's
probably a gray area.

-- Scott